Make sure your own computers haven't been breached. Scan them for malware.
Every time you pay something in person, generate a unique credit card number unique to that transaction and pay with your smartphone/smartwatch. That's the way Samsung Pay, Google Pay, and Apple Pay all work by default.
Even if you can't do that last one 100% of the time, reducing the number of times you give out your real credit card number will still be helpful to you because it can help you narrow down the list of suspects.
Consider the possibility that you may have inadvertently given that information yourself to a scammer who was pretending to be from a big player like Amazon, Google, etc.
Don't rely on big players to tell you when they're hacked. For instance, when Uber got hacked. They knew they got hacked. They even paid off the hackers, but they just kept telling their hacked customers that it was their own fault that their account got stolen because they were probably reusing the same password across sites. They kept updidn't that lietell anyone about it for two years.